7d3d98783b5c84a137b0261194617e3ae0d885be7bb3fb69bd44ca3292078c95

Analysis

max time kernel
210s
max time network
323s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 22:28

Target

7d3d98783b5c84a137b0261194617e3ae0d885be7bb3fb69bd44ca3292078c95.dll
Size

44KB
MD5

5dfdf775a173b4e3dbccdc4454effe81
SHA1

bf9a4b8a5d998223fa85f1198acad7a7e235dbc0
SHA256

7d3d98783b5c84a137b0261194617e3ae0d885be7bb3fb69bd44ca3292078c95
SHA512

89955d0236e115c205b34e9d434263bc189a2989a9837ddebff08c52b779209d4046a3d02af0853540cb1fcff631492389b189016f2f18342656f1f11ca4d06e
SSDEEP

768:d7ABOOSbtCEaTJTQQE3tWIsVofOk4NMxfQGrC1Fpo9A/HpAx:NAoCEaTJTQ53oIsVk42JQXzoCHpU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	1912	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 1912	3676	rundll32.exe	80
PID 3676 wrote to memory of 1912	3676	rundll32.exe	80
PID 3676 wrote to memory of 1912	3676	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d3d98783b5c84a137b0261194617e3ae0d885be7bb3fb69bd44ca3292078c95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d3d98783b5c84a137b0261194617e3ae0d885be7bb3fb69bd44ca3292078c95.dll,#1
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 560
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1912 -ip 1912
1⤵
PID:380